Is it possible to use the same subsearch twice in a search? Of course without having Splunk to execute the search twice, but having it caching the results.
i think, its possible to use the same subsearch twice in a query.
also, the limits.conf has a parameter "ttl" - Time to cache a given subsearch's results, in seconds, default value 300 seconds.
on Splunk Enterprise, limits.conf
Maximum number of results to return from a subsearch.
This value cannot be greater than or equal to 10500.
Defaults to 10000.
Maximum number of seconds to run a subsearch before finalizing
Defaults to 60.
Time to cache a given subsearch's results, in seconds.
Do not set this below 120 seconds.
Defaults to 300.
View solution in original post